Two things need protecting: candidates’ personal data and your item bank. We describe our practices plainly here and do not claim certifications we do not hold.
What protects your data
The same controls apply on every plan.
Encryption at every stage
TLS 1.2 or later in transit; AES-256 at rest for records, recordings and backups.
U.S. data hosting
Candidate data, item banks, recordings and backups are hosted in the United States.
Role-based access
Authors, reviewers, proctors and administrators see only what their role allows.
Single sign-on
Staff and candidates sign in through SAML 2.0 or OpenID Connect, under your own identity rules.
Item exposure controls
Forms lock for each window, items rotate across forms, and exposure counts show what to retire.
Audit logs
Every view, edit, score change and accommodation approval is logged with the person and time.
Retention you set
Retention is set per record type; on exit we export everything and delete our copies within 30 days.
Incident notice
If an incident affects your data, your named contacts hear from us in writing, on the contract’s timeline.
Questionnaire answers on request
Most buyers send a security questionnaire before they sign. We answer it in full and add an architecture overview showing where data lives, how it moves and who can reach it. We hold no SOC 2, ISO 27001 or FedRAMP certification, and our answers say so plainly.
Security questions buyers ask
Where is candidate data stored?
In the United States. Candidate records, item banks, proctoring recordings and backups are all hosted in the United States, and none of it is moved abroad for processing. If your contract needs a particular U.S. region or a named hosting arrangement, raise it during scoping and we confirm in writing what we can offer.
Does Exampit hold SOC 2 or ISO 27001 certification?
No. Exampit does not hold SOC 2, ISO 27001, FedRAMP or StateRAMP certification. Instead we describe our controls plainly, answer your security questionnaire in full and share an architecture overview, so your IT or procurement team can judge the controls directly against its own requirements.
How do you protect the item bank from exposure?
Through access, rotation and measurement. Only named authors and reviewers see live items. Forms lock for each window, items rotate across forms, and exposure counts show how often each item has been seen. During a session the secure browser blocks copying, printing and other applications, and proctors review anything flagged.
Can we use our own single sign-on?
Yes. Staff and candidates can sign in through SAML 2.0 or OpenID Connect, so your identity provider controls passwords, multifactor rules and offboarding. Roles inside Exampit are then set per person, and every sign-in is written to the audit log, which you can export at any time.
What happens to our data if we leave?
You receive a full export: the item bank as QTI, results and audit logs as CSV, and recordings as files. We then delete our copies within 30 days unless you ask us in writing to keep them longer. Your retention settings apply until the day of deletion.
Bring your security questionnaire
Send it ahead of your demo and we will walk through the answers with your IT lead.